US 12,481,679 B2
Searching remote data in an observability pipeline system
Clint Sharp, Oakland, CA (US); Dritan Bitincka, Edgewater, NJ (US); Ledion Bitincka, San Francisco, CA (US); and Oliver Draese, Los Gatos, CA (US)
Assigned to Cribl, Inc., San Francisco, CA (US)
Filed by Cribl, Inc., San Francisco, CA (US)
Filed on May 22, 2023, as Appl. No. 18/321,189.
Claims priority of provisional application 63/423,264, filed on Nov. 7, 2022.
Claims priority of provisional application 63/419,632, filed on Oct. 26, 2022.
Claims priority of provisional application 63/414,762, filed on Oct. 10, 2022.
Claims priority of provisional application 63/344,864, filed on May 23, 2022.
Prior Publication US 2023/0376483 A1, Nov. 23, 2023
Int. Cl. G06F 16/28 (2019.01); G06F 11/34 (2006.01); G06F 16/2453 (2019.01); G06F 16/2457 (2019.01); G06F 16/2458 (2019.01); G06F 16/248 (2019.01); H04L 67/1021 (2022.01)
CPC G06F 16/287 (2019.01) [G06F 11/3419 (2013.01); G06F 16/2453 (2019.01); G06F 16/2457 (2019.01); G06F 16/2471 (2019.01); G06F 16/248 (2019.01); H04L 67/1021 (2013.01)] 26 Claims
OG exemplary drawing
 
1. A method of searching remotely-stored data without needing to index or move all of the remotely-stored data, the method comprising:
receiving a search query at a computer node located at a node geolocation relating to stored data stored at a storage geolocation, wherein the search query is received from a user device and the stored data includes data obtained from data source computing resources other than the user device;
identifying computing resources available to an observability pipeline system for performing a data search, the computing resources associated with respective compute geolocations, each of the compute geolocations being distinct from the node geolocation and the storage geolocation;
obtaining latency data comprising latency values for the compute geolocations, wherein a latency value of the latency values represents an efficiency of network communication between the storage geolocation and a compute geolocation of the compute geolocations;
selecting one of the compute geolocations based on the latency data;
by operation of a coordinator agent on the computer node, initiating a dynamic computing resource at the selected compute geolocation, wherein initiating the dynamic computing resource comprises transmitting the search query from the computer node at the node geolocation to the dynamic computing resource at the compute geolocation; and
by operation of the coordinator agent on the computer node, receiving search results identified by the dynamic computing resource based on the search query,
wherein the search results are obtained by the dynamic computing resource by:
configuring an observability pipeline process based on the search query, and
executing the observability pipeline process.